chore: replace security-header-lambda with native cloudfront responseheaderpolicy

packages/ts-scripts/src/cdk/components/security-headers.ts

@@ -0,0 +1,55 @@
+import { Duration, Stack } from 'aws-cdk-lib'
+import {
+  CfnDistribution,
+  CloudFrontWebDistribution,
+  Distribution,
+  HeadersFrameOption,
+  HeadersReferrerPolicy,
+  ResponseHeadersPolicy,
+} from 'aws-cdk-lib/aws-cloudfront'
+
+const defaultContentSecurityPolicy =
+  "default-src 'self' *.reapit.cloud *.chatlio.com *.pusher.com *.googleapis.com https://cognito-idp.eu-west-2.amazonaws.com https://cognito-idp.ap-southeast-2.amazonaws.com https://www.google-analytics.com *.sentry.io https://sentry.io *.visualstudio.com *.sagepay.com *.elavon.com https://reapit-marketplace-app-media-dev.s3.eu-west-2.amazonaws.com https://reapit-swagger-dev.s3.eu-west-2.amazonaws.com https://reapit-swagger-prod.s3.eu-west-2.amazonaws.com https://reapit-marketplace-app-media-prod.s3.eu-west-2.amazonaws.com blob: *.googleapis.com *.pusherapp.com wss://ws.pusherapp.com *.zdassets.com *.zendesk.com wss://widget-mediator.zopim.com wss://ws-eu.pusher.com *.mixpanel.com https://api.github.com/ *.chatbase.co"
+const imageContentSecurityPolicy =
+  "img-src 'self' data: *.reapit.cloud *.chatlio.com https://cdn.jsdelivr.net https://maps.gstatic.com https://maps.googleapis.com blob: https://reapit-marketplace-app-media-dev.s3.eu-west-2.amazonaws.com https://reapit-marketplace-app-media-prod.s3.eu-west-2.amazonaws.com https://*.githubusercontent.com *.chatbase.co"
+const scriptContentSecurityPolicy =
+  "script-src 'self' *.reapit.cloud *.chatlio.com https://cdn.jsdelivr.net https://unpkg.com *.sagepay.com *.elavon.com https://maps.googleapis.com https://www.google-analytics.com *.zdassets.com *.pusher.com *.zopim.com *.chatbase.co"
+const styleContentSecurityPolicy =
+  "style-src 'self' 'unsafe-inline' *.reapit.cloud *.chatlio.com https://cdn.jsdelivr.net https://fonts.googleapis.com"
+const objectContentSecurityPolicy = "object-src 'self' *.reapit.cloud"
+const fontContentSecurityPolicy = "font-src 'self' *.reapit.cloud https://fonts.gstatic.com"
+const frameContentSecurityPolicy =
+  "frame-src 'self' *.reapit.cloud https://foundations-documentation.reapit.cloud *.powerbi.com *.powerapps.com *.windows.net *.visualstudio.com https://www.youtube.com *.reapit.com https://player.vimeo.com https://explorer.embed.apollographql.com *.chatbase.co"
+
+export const createSecurityHeaders = (stack: Stack, id: string, webDistribution: CloudFrontWebDistribution) => {
+  const iframePolicy = stack.stackName.includes('payments') ? "frame-src 'self' https://*" : frameContentSecurityPolicy
+  const contentSecurityPolicy = `${defaultContentSecurityPolicy}; ${imageContentSecurityPolicy}; ${scriptContentSecurityPolicy}; ${styleContentSecurityPolicy}; ${objectContentSecurityPolicy}; ${fontContentSecurityPolicy}; ${iframePolicy}`
+  const myResponseHeadersPolicy = new ResponseHeadersPolicy(stack, id, {
+    securityHeadersBehavior: {
+      contentSecurityPolicy: { contentSecurityPolicy, override: true },
+      contentTypeOptions: { override: true },
+      frameOptions: { frameOption: HeadersFrameOption.DENY, override: true },
+      referrerPolicy: { referrerPolicy: HeadersReferrerPolicy.NO_REFERRER, override: true },
+      strictTransportSecurity: {
+        accessControlMaxAge: Duration.seconds(63072000),
+        preload: true,
+        includeSubdomains: true,
+        override: true,
+      },
+      xssProtection: {
+        protection: true,
+        modeBlock: true,
+        override: true,
+      },
+    },
+  })
+
+  const cfnDistribution = webDistribution.node.defaultChild as CfnDistribution | undefined
+  if (!cfnDistribution) {
+    throw new Error('Could not find CloudFront Distribution')
+  }
+  cfnDistribution.addPropertyOverride(
+    'DistributionConfig.DefaultCacheBehavior.ResponseHeadersPolicyId',
+    myResponseHeadersPolicy.responseHeadersPolicyId,
+  )
+}

packages/ts-scripts/src/cdk/components/site.ts

@@ -14,6 +14,7 @@ import { CanonicalUserPrincipal, PolicyStatement } from 'aws-cdk-lib/aws-iam'
 import { BlockPublicAccess, BucketAccessControl, BucketEncryption, ObjectOwnership } from 'aws-cdk-lib/aws-s3'
 import { ACM } from 'aws-sdk'
 import { InvalidateCloudfrontDistribution } from '../utils/cf-innvalidate'
+import { createSecurityHeaders } from './security-headers'
 
 export interface CreateSiteInterface {
   env?: 'dev' | 'prod'
@@ -131,6 +132,8 @@ export const createSite = async (
     ],
   })
 
+  createSecurityHeaders(stack, 'SecurityHeaders', distribution)
+
   createRoute(stack, 'route', {
     target: route53.RecordTarget.fromAlias(new targets.CloudFrontTarget(distribution)),
     zone: hostedZone,

yarn.lock

@@ -8051,27 +8051,6 @@ __metadata:
   languageName: unknown
   linkType: soft
 
-"@reapit/security-header-lambda@workspace:packages/security-header-lambda":
-  version: 0.0.0-use.local
-  resolution: "@reapit/security-header-lambda@workspace:packages/security-header-lambda"
-  dependencies:
-    "@reapit/config-manager": "workspace:packages/config-manager"
-    "@reapit/ts-scripts": "workspace:packages/ts-scripts"
-    "@typescript-eslint/eslint-plugin": "npm:^8.10.0"
-    "@typescript-eslint/parser": "npm:^8.10.0"
-    aws-lambda: "npm:^1.0.7"
-    eslint: "npm:8.57.1"
-    eslint-plugin-prettier: "npm:^5.2.1"
-    serverless: "npm:^3.39.0"
-    serverless-deployment-bucket: "npm:^1.6.0"
-    serverless-lambda-edge-pre-existing-cloudfront: "npm:^1.2.0"
-    serverless-plugin-log-retention: "npm:^2.0.0"
-    snyk: "npm:^1.1293.1"
-    tsup: "npm:^6.7.0"
-    typescript: "npm:^5.6.3"
-  languageName: unknown
-  linkType: soft
-
 "@reapit/ts-bundler@workspace:packages/ts-bundler":
   version: 0.0.0-use.local
   resolution: "@reapit/ts-bundler@workspace:packages/ts-bundler"
@@ -26945,13 +26924,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"serverless-lambda-edge-pre-existing-cloudfront@npm:^1.2.0":
-  version: 1.2.0
-  resolution: "serverless-lambda-edge-pre-existing-cloudfront@npm:1.2.0"
-  checksum: 267d921afe59b5ae30045d5eaf0911129e5aa09dfd65762824fa95e57336d2e0490277789f0b2d3048967d3b97888e380bc7e550068e49f68d2498b861348f15
-  languageName: node
-  linkType: hard
-
 "serverless-offline@npm:^12.0.4":
   version: 12.0.4
   resolution: "serverless-offline@npm:12.0.4"